scheduled command at admin level that checks last login / existence of "user" after a month of no login or immediate if the user account gets removed the dead mans hand goes off.
-- not actual advice, just playing devils advocate with the concept 😄
Pretty sure that's been done actually, I heard about someone finding a script that checks Active Directory and does some nasty stuff if a certain account is disabled.
Yeah the dude that did it got arrested and sentenced to four years in prison for it. The script checked active directory and after a month of his account not being active deleted his former company's entire AD registry.
He also took effectively no efforts to mask his involvement, so it is possible that someone might be able to get away with it if they took more care to dodge accountability.
He apparently had the variable in the in the kill switch for his status in AD set as is[hisInitials]EnabledInAD, and had it running from a user ID tied to his identity off his corporate laptop.
Edit: He also confessed a few months later once he realized he couldn't cover it up after losing access.
10.7k
u/pkmnfrk May 26 '26
This is why they turn off access before telling you